4deac00aebae12a2ee1524571cf72d24874fac56bba59e6bea635e570dabe7f1

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_3bd0b0733a658595f677160f55756c0c_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260728-253zmabp21
SHA256 4deac00aebae12a2ee1524571cf72d24874fac56bba59e6bea635e570dabe7f1
MD5 3bd0b0733a658595f677160f55756c0c
SHA1 03b7c5d18a1b08bc8cb5c94b681795a3adf197af
SHA512 24846b99241672169d3bf57c6eaa6150ff187da1cd4d0f28083d59fbb5b57b2c7d46601399124f04548f2938ab7a4a788d75f4924fa2ca7d6d9a02fc0763961c
SSDEEP 49152:Qoa1taC070dDsSxqKrinRFN6jRhb/gdKMHfErOYdhtmV:Qoa1taC0epZsFN6nbAmyYdho
TLSH
T1B8952251F792C2B1C8821A70A542C3E3E8B93D7D96458D837BDC1B2E2DA4EC05E71B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4988	C138.tmp

Executes dropped EXE 1 IoCs

pid	Process
4988	C138.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_3bd0b0733a658595f677160f55756c0c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C138.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4988	1080	2026-07-28_3bd0b0733a658595f677160f55756c0c_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_3bd0b0733a658595f677160f55756c0c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_3bd0b0733a658595f677160f55756c0c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\C138.tmp
  "C:\Users\Admin\AppData\Local\Temp\C138.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_3bd0b0733a658595f677160f55756c0c_amadey_elex_smoke-loader.exe 9F66CFDD2F47414B70176B87E3561360F67773D2A9E24FE656C7CE4A8B55AE90977E8384C687D7472C51E0F3324D20B13F72126174355F61DA459BBB72007DE9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C138.tmp

Path C:\Users\Admin\AppData\Local\Temp\C138.tmp
Size 1.9MB
SHA256 851281da3305a91248bd9a6f4991e91cce1b9566a29680d708c933dc8d060a65
MD5 112d2fe08d779c996b29d5063c2c74e1
SHA1 6e46cdefd0adcbc7ad68f0db44aa5d8c3c4d990a
SHA512 166c29d83e8f2164efaad5a89fc0a6141c3a70dc7aabd284e2e94d200308342f567da8e44d1a929cbeecb76773947da076641ec7d8e590a56806aef69cecb8cf
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dyEu/6R4NhhA1yprK5UgPMFjcaMi4Qxtjm+sC:Qoa1taC070d/u/HV45UAJaMi4QDR
TLSH
T1A1952351F795C1B1C0910A71BAA1C7E6DC753E7C4A454E83AFD81B3F2D94EC0AAB2A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4988-6-0x0000000000400000-0x00000000005E6000-memory.dmp